EIP-2026-114253

This exploit demonstrates a local file download vulnerability in the WordPress wp-FileManager plugin. By manipulating the 'path' and 'filename' parameters in a crafted URL, an attacker can download arbitrary files from the server, such as 'wp-config.php'.